Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My client's lan includes two soho routers, one of which is a Cisco RV042 and the other of which just died. Each of those routers was connected to an ISP provided router (Cisco IAD series) which presents to the company's T1.

Most of the workstations use the RV042 for a gateway. A few machines point to the now-failed soho router.

I don't really want to replace the old soho router and would prefer that all of the machines used the same soho router for a gateway to the Internet.

The problem is that machines that point to the broken soho router are all part of a busted Windows Server domain that now has no server to handle authentication. It is impossible to get admin privileges on these machines. Technician toolkit programs that wack the sam or whatever to handle lost administrative passwords only work on non-domain machines.

I have several linux boxes on this lan and it seems like it shouldn't be too difficult to configure one of those boxes to use iptables to masquerade as the broken gateway device and forward the packets to the single remaining gateway. This would be a temporary measure until I could get rid of those windows workstations for good.

This is a legacy network that I am converting over to pure linux servers and workstations.

Can anyone out there shed some light on how this might be done?

Public Network:

Private lan:




share|improve this question
Can you simply add to the inside interface in addition to on the functional router? – Zoredache Dec 1 '11 at 22:30


It's not entirely clear if you are talking about some kind of tiered routing, or if you just want general NAT'd access for all your machines on the LAN; I'm going to assume it's the later (the most generic and useful case) so, you need to:

  • set up an IP (alias?) for the broken router on your newly-minted *nix box

Your best bet (and to keep things from "breaking" further) is to simply alias the internal NIC on the linux box that points to the LAN. This is easy:

ifconfig eth0:0 netmask 

... which will bind the IP address to the linux box. If it's taking over full time and you don't care about the broken router coming back, just assign the address outright:

ifconfig eth0 netmask

Note that this is a temporary arrangement, it will not survive a reboot because all you've done is reconfigure the network interface in memory. You'll need to find out how your specific distro saves changes and do so to ensure it shows up on each reboot.

  • set up iptables to mangle the packets using DNAT

A little trickier. This takes the general form:

iptables -t nat -A POSTROUTING -s -d ${destination-network} -j SNAT --to-source

...although it can certainly be adjusted. This single line gives full NAT'd internet access, much like a home router. I'm not entirely clear if you are wanting this, or wanting something else, so this seemed to be the most generic (applicable) answer. If you are wanting "plain ol' NATing" then it looks like this:

iptables -t nat -A POSTROUTING -s -j SNAT --to-source

You'll also need to save this in a file because the setting is also in memory and won't survive a reboot.

  • make sure your firewall doesn't eat your new-found routing

Sounds silly, but in some cases, you may have a firewall enabled by default, so better safe than sorry:

iptables -I INPUT 1 -s -j ACCEPT
iptables -I FORWARD 1 -s -j ACCEPT

This also needs saved just like the prior firewall rule.

  • ensure that IP forwarding is enabled

Without IP forwarding enabled, you'll get jack-diddly in the packet movement department.

sysctl -w net.ipv4.ip_forwarding = 1

This is transient and will not survive a reboot, be sure to save it or it'll eat kittens, etc.

share|improve this answer

Technician toolkit programs that wack the sam or whatever to handle lost administrative passwords only work on non-domain machines.

I realize my answer is not technically relevant to your overall question, but I did want to get clarification/make a comment - You should be able to whack the SAM to reset the local Administrator password on the machine, then login as said local Administrator, and disjoin from the domain. Disjoining from a domain does NOT require a live Domain Controller. You should be able to get the machine off, unless there is literally no local Administrator account on those machines.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.